PGP Desktop service fails to validate user supplied data

Overview PGP Desktop fails to properly validate objects passed into the PGP Desktop service. This vulnerability may allow a remote, authenticated attacker to execute arbitrary code. Description PGP Desktop versions prior to 9.5.1 fail to properly validate objects passed into the PGP Desktop servi...

Messageriescripthp 2.0 - 'existeemail.php?email' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21513/info Messageriescripthp is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to...

CubeCart 3.0.x - adminprint_order.php?order_id SQL Injection

CubeCart 3.0.x - adminprintorder.php?orderid SQL Injection source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to proper...

BandSite CMS 1.1 - help_news.php Cross-Site Scripting

BandSite CMS 1.1 - helpnews.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20137/info Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. These issues may allow an attacker to access...

Secure Elements Class 5 AVR server fails to properly validate pathnames when downloading updates

Overview The Secure Elements Class 5 AVR server fails to properly validate pathnames when downloading updates. This may allow an attacker to overwrite arbitrary files on the server system. Description Class 5 AVR Secure Elements Class 5 AVR Automated Vulnerability Remediation is a security produc...

Quick Square Development Honeycomb Archive 3.0 - 'CategoryResults.cfm' Multiple SQL Injections

source: https://www.securityfocus.com/bid/15995/info HoneyComb Archive is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabilities could result in a compromis...

Community Enterprise 4.x - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/15963/info Community Enterprise is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabilities could result in a...

McGallery 1.0/1.1/2.2 - 'index.php?album' SQL Injection

source: https://www.securityfocus.com/bid/15845/info mcGallery PRO is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabilities could result in a compromise of...

OTRS 2.0 - AgentTicketPlain Action Multiple SQL Injections

source: https://www.securityfocus.com/bid/15537/info OTRS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The application is prone to multiple SQL-injection vulnerabilities, an HTML-injection...

Simple PHP Blog 0.4 - preview_static_cgi.php Multiple Cross-Site Scripting Vulnerabilities

Simple PHP Blog 0.4 - previewstaticcgi.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize...

Simple PHP Blog 0.4 - 'preview_cgi.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed i...

EPay Pro 2.0 - index.php Directory Traversal

EPay Pro 2.0 - index.php Directory Traversal source: https://www.securityfocus.com/bid/14871/info EPay Pro is prone to a directory traversal vulnerability. This is due to a lack of proper validation of user-supplied input. An unauthorized user can retrieve arbitrary files by supplying directory...

ATutor 1.5.1 - Chat Logs Remote Information Disclosure

ATutor 1.5.1 - Chat Logs Remote Information Disclosure source: https://www.securityfocus.com/bid/14832/info ATutor is prone to a remote information disclosure vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged...

ATutor 1.5.1 - Chat Logs Remote Information Disclosure

source: https://www.securityfocus.com/bid/14832/info ATutor is prone to a remote information disclosure vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged information. A remote attacker can exploit this...

igallery33.txt

Hat-Squad Advisory: i-Gallery directory traversal Product: i-Gallery Vendor Url: http://www.b-cp.com Version: 3.3 older versions not tested , but assumed vulnerable Vulnerability: Directory traversal and CSS bug Release Date: Vendor Status: Informed: 15 June 2005 Second Contact: 19 June 2005...

[HV-HIGH] Microsoft Jet DB engine vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Microsoft Jet DB engine vulnerabilities Classification: =============== Level: low-med-HIGH-crit ID: HEXVIEW200503311 URL: http://www.hexview.com/docs/20050331-1.txt Overview: ========= Microsoft Jet database is a lightweight database widely used by M...

PhotoPost Pro 5.1 - showmembers.php Multiple Cross-Site Scripting Vulnerabilities

PhotoPost Pro 5.1 - showmembers.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/12920/info Multiple input validation vulnerabilities reportedly affect PhotoPost Pro. These issues are due to a failure of the application to properly sanitize user-supplied...

MySQL 4.x - CREATE FUNCTION Arbitrary libc Code Execution

source: https://www.securityfocus.com/bid/12781/info MySQL is reported prone to multiple vulnerabilities that can be exploited by a remote authenticated attacker. The following individual issues are reported: - Insecure temporary file-creation vulnerability. Reports indicate that an attacker with...

CitrusDB 0.3.6 - importcc.php CSV File SQL Injection

CitrusDB 0.3.6 - importcc.php CSV File SQL Injection source: https://www.securityfocus.com/bid/12557/info CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue...

AWStats: Remote code execution

Background AWStats is an advanced log file analyzer and statistics generator. Description When 'awstats.pl' is run as a CGI script, it fails to validate specific inputs which are used in a Perl open function call. Furthermore, a user could read log file content even when plugin rawlog was not...